Reconfiguring redundancy management

ABSTRACT

Input signals from sensor (S) in a redundancy management system are provided redundantly in parallel so that a primary control signal may be selected. Median value signals for groups of three sensors are detected in median value selectors (30, 32, 34, 36, 40) of selection filters (F). The detected median value signals are then also compared in a subtractor/comparator (38) to determine whether any of them exceed the others by an amount greater than the signal level for a failed sensor. If so, the exceeding detected medium value signal is sent to a control computer (10) as the primary control signal. If not, the lowest level detected medium value signal is sent as the primary control signal.

ORIGIN OF THE INVENTION

The invention described herein was made in the performance of work undera NASA contract and is subject to the provisions of Section 305 of theNational Aeronautics and Space Act of 1958, Public Law 85-568 (72 Stat.435; U.S.C. 2457).

DESCRIPTION

1. Technical Field

The present invention relates to error detection and redundancymanagement of multiple sensors.

2. Background Art

In certain applications where reliability is critical, such as inadvanced avionic systems, redundant components such as sensors,computers and actuators are used. Failures of such components aredetected and the system is reconfigured to compensate for the detectedfailure. System reliability thus becomes a function of how successfullythe redundant equipment can be managed. Examples of such systems arethose of U.S. Pat. Nos. 3,895,223, 3,665,173 and 4,084,774.

In certain situations, sensor null failures occurred where a sensorwould fail and produce a null or zero output plus or minus somespecified tolerance level. Another type of sensor failure has beentermed a hardover failure, where a sensor would fail and provide a fullamplitude signal. For spacecraft in quiescent flight, it has beendifficult to detect and identify sensor null failures, because nominalvehicle rates of close to zero degrees/second did not differ appreciablyfrom a null failure sensor reading. Additionally, during long periods ofquiescent flight two separate null failures could have occurred and goneundetected.

In U.S. Pat. No. 3,639,778, voting circuits were used which operated inaccordance with a truth table to select the second most positive inputsignal in one-half of the possible input conditions and the second mostnegative input signal for the other one-half of the possible inputs.However, situations existed where this selection technique would selecta failed sensor input signal as the proper input signal due to the inputselection criteria.

Another technique has been to form some form of weighted average valueof the various input signals for use as a comparison reference, such asin U.S. Pat. Nos. 3,667,057; 3,681,578 and 3,979,720. However insituations where actual sensed values are quite close in magnitude tothe output of failed sensors, the desirability of weighted averagecomparison has been questioned.

DISCLOSURE OF INVENTION

Briefly, the present invention relates to the selection of a primarycontrol signal for redundancy management in a system having a pluralityof sensors providing input signals redundantly in parallel to at leastone control computer to provide the computer with the primary controlsignal representing an output from a properly operating, rather than afailed, sensor. In the preferred embodiment, the sensors are in anaircraft or spacecraft avionics system and include accelerometers andgyroscopes for flight control of the craft. The present invention may beperformed with analog circuitry, digital circuitry or in a properlyprogrammed digital computer.

Input signals in groups of three from the sensors are received andcompared so that the median value signal of the three input signals canbe detected. As used in the present invention, median value signal isdefined as being the one of the input signals which is greater than orequal to one of the other two input signals while also being less thanor equal to the other input signal.

The detected median value signals are then compared to determine if anyone of the detected median value signals exceeds the others by an amountgreater than the signal level for a failed sensor. If this is the case,the detected median value signal which exceeds the others is transmittedto the control computer as the primary control signal. If it is not thecase, the primary control signal transmitted to the control computer isthe one of lowest amplitude.

With the present invention the system continually reconfigures theredundant sensor inputs so as to minimize failure effects on systemperformance. Dual null failures of two sensors or a hardover failure ofone sensor can be tolerated with the present invention. Further, due tothe continual reconfiguration occurring prior to any attempt atdetection or identification of the nature of the sensor failure,redundancy management may be performed at a later time and at a slowerrate, minimizing computation load on the control computer.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a schematic diagram of a redundancy management systemincorporating the present system therein;

FIG. 2 is a schematic diagram of an apparatus according to the presentinvention;

FIGS. 3 and 4 are waveform diagrams illustrating the operation of FIG.2; and

FIGS. 5 and 6 are schematic circuit diagrams of alternative circuitrywhich may be used in the apparatus of FIG. 2.

BEST MODE FOR CARRYING OUT THE INVENTION

In the drawings, a redundancy management system is set forth having aplurality of sensors S providing input signals redundantly in parallelto at least one control computer 10 to provide the computer 10 with aprimary control signal representing the output from a properlyoperating, rather than a failed, sensor S. In the preferred embodiment,the sensors are in an aircraft or spacecraft avionics system, althoughit should be understood that the present invention may also be used inother types of redundancy management systems, if desired. As is typicalin redundancy management systems, a plurality of control computers 10 oflike structure and function are provided to operate in a parallelarrangement.

In the preferred embodiment, the sensors S are arranged into a number ofgroups of like number to the number of control computers 10, with eachsensor group including a normal accelerometer 12, a lateralaccelerometer 14, a roll gyro 16, a pitch gyro 18 and a yaw gyro 20.

Each of the groups of sensors S is electrically connected to anindividual multiplexer/demultiplexer 22 which sequentially samples thesensors S connected thereto to determine the readings of such sensors.Since the multiplexer/demultiplexer circuits 22 are of like structureand function, they bear like reference numerals in the drawings.

A plurality of input/output (I/O) data busses 24 of like structure andfunction are electrically connected to receive the readings from eachgroup of sensors S from the plural multiplexer/demultiplexers 22 toprovide the computer 10 associated therewith with data readings fromeach of the groups of sensors in the form of multiple parallel channelsor data streams.

A selection filter F according to the present invention receives thechannels from the input/output bus 24 associated therewith and, in amanner to be set forth below, provides the computer 10 with a primarycontrol signal SS, or selected signal, representing an output from aproperly operating, rather than a failed, sensor. The input/outputbusses 24 further provide the parallel channels of data from the sensorgroups to a failure detection, identification and recovery operator 26,which may be any of several conventional types which detect failedsensors and provide fault status signals to a display status indicator28. The failure detection operator 26 further provides channel selectionsignals to the selection filter F in the event that a failure isdetected. The failure detection technique depends, of course, on theparticular type of conventional failure detection operator 28 used andthe number of failures detected and identified.

When all four channels are operating and no failures have been detectedin the failure detection operator 26, the selection filter F of thepresent invention operates to group the channels or input signals fromthe input/output busses 24 into groups of three, comparing the groups ofthree signals to choose the median value signal of the three inputsignals. As used in the present invention, median value signal isdefined as being the one of the input signals which is greater than orequal to one of the other two input signals while also being less thanor equal to the other input signal.

In the selection filter F (FIG. 2), the detected median value signalsare then compared to determine if any of the detected signals exceedsthe others by an amount greater than the signal level for a failedsignal. If this is the case, the detected median value signal whichexceeds the others in such a manner is transmitted to the controlcomputer 10 as the primary control signal. If no detected median valuesignal so exceeds the others, the primary control signal transmittedfrom the selection filter F to the control computer 10 is the one havingthe lowest amplitude.

For example, in accordance with the present invention, for three inputsignals, a, b, c, the following control laws apply for definition ofmedian value signal MVS depending upon the relative amplitude of thesignals:

    ______________________________________                                        WHERE  b ≦ a ≦ c OR c ≦ a ≦ b                                                THEN MVS = a                                       WHERE  a ≦ b ≦ c OR c ≦ b ≦ a                                                THEN MVS = b                                       WHERE  a ≦ c ≦ b OR b ≦ c ≦ a                                                THEN MVS = c                                       ______________________________________                                    

The selection filter F operates in accordance with these control laws toprovide the control computer 10 with a proper primary control signal.The functions performed by the selection filter F may be implementedwith a digital circuit, an analog circuit or may be performed in aproperly programmed computer.

The operation of the present invention can more readily be understood byreference to FIG. 2, which indicates the functions performed by theselection filter F, in whichever format. In the selection filter F, thechannels of data from input/output bus 24 are provided in groups ofthree to four median value selector circuits or operators 30, 32, 34 and36.

The median value selector value operator 30 forms a first selectorsection and receives input signals from channels 1, 2 and 3 and selectsthe median value signal therefrom, providing same as an input signal Ato a subtractor/comparator 38. The median value selector operators 32,34 and 36 form a first selector stage of a second selector section andreceive input signals from the channels as indicated in FIG. 2, eachselecting a median value signal from the three presented thereto andproviding such median value signals as inputs to a median value selectoroperator 40 which forms a second selector stage of the second selectorsection. The median value selector 40 selects a median value signal fromthe three presented thereto from the median value selectors 32, 34 and36 and provides the selected median value signal as an input signal B tothe subtractor/comparator operator 38. Each of the median valueselectors 30, 32, 34, 36 and 40 operate to indicate a median valuesignal from the three provided thereto in accordance with the controlslaws defined above. Specific circuitry for performing this function andprocessing step will be set forth below.

In the subtractor/comparator operator 38, the absolute magnitude of theinput signal B is subtracted from the absolute magnitude of the inputsignal A and the result obtained compared in a comparator with areference level C, representing the maximum possible signal level outputof a rate gyro which has failed to null. In the event that the absolutevalue of the input signal A to the subtractor/comparator 38 exceeds theabsolute value of the input signal B by an amount greater than thereference level signal C, the subtractor/comparator operator 38 providesthe signal A as the proper control signal SS to the flight controlcomputer 10. In the event that the results of subtraction do not exceedthe reference level C, the lower value input signal B is provided as theproper control signal SS to the computer 10.

From the foregoing, it can be seen that the functions performed in thesubtractor/comparator operator 38 automatically selects a rate gyrooutput which exceeds the output of a rate gyro failed to null, and cancontinually reconfigure even where there are dual null failures. Toillustrate, turning now to FIG. 3, the following charts represent outputsignals in the selection filter F at various times:

                  CHART I                                                         ______________________________________                                        ALL FOUR CHANNELS OPERATING                                                   COMPONENT            OUTPUT (CHANNEL)                                         ______________________________________                                        SELECTOR 30          2                                                          32                 2                                                          34                 3                                                          36                 3                                                          40                 3                                                        SUBTRACTOR/COMPARATOR 38                                                                           3                                                        ______________________________________                                    

                  CHART II                                                        ______________________________________                                        CHANNEL 3 FAILS NULL                                                          COMPONENT            OUTPUT (CHANNEL)                                         ______________________________________                                        SELECTOR 30          1                                                          32                 2                                                          34                 1                                                          36                 2                                                          40                 2                                                        SUBTRACTOR/COMPARATOR 38                                                                           2                                                        ______________________________________                                    

                  CHART III                                                       ______________________________________                                        CHANNEL 2 NOW ALSO FAILS NULL                                                 COMPONENT            OUTPUT (CHANNEL)                                         ______________________________________                                        SELECTOR 30          NULL                                                       32                 1                                                          34                 1                                                          36                 NULL                                                       40                 1                                                        SUBTRACTOR/COMPARATOR 38                                                                           1                                                        ______________________________________                                    

Referring now to FIG. 4, the following chart sets forth the operation ofthe selection filter F to detect the proper control signal in the eventof a hardover failure to one of the sensors providing data in the inputchannel thereto. Prior to the hardover failure of channel 3 illustratedin FIG. 4, the output signals from the components of the selectionfilter F are as set forth in Chart I above.

                  CHART IV                                                        ______________________________________                                        CHANNEL 3 FAILS HARDOVER                                                      COMPONENTS           OUTPUT (CHANNEL)                                         ______________________________________                                        SELECTOR 30          1                                                          32                 2                                                          34                 1                                                          36                 2                                                          40                 2                                                        SUBTRACTOR/COMPARATOR 38                                                                           2                                                        ______________________________________                                    

Thus, with the present invention, dual null failures or one hardoverfailure can be tolerated while still ensuring that the control computers10 receive a proper control signal.

DIGITAL IMPLEMENTATION

In FIG. 5, a digital implementation for the median value selector 30operator in the selection filter F is set forth to implement and detectthe median value signal presented thereto in accordance with theoperating control laws set forth above. Other than the particularchannel inputs provided thereto, selectors 32, 34 and 36 and 40 are oflike function and operation. Suitable power supplies and timing andcontrol signals are, of course, provided. The input signals are firstfurnished to a bank of comparators by the connection indicated. Thethree input signals are also furnished to separate storage registers 42,44 and 46 and are stored therein. A comparator 48 forms a logic "1" ifthe data on channel 1 exceeds in magnitude the data on channel 2. Shouldthe data value on channel 2 exceed the data value on channel 1, thecomparator 48 forms a logic "0" output signal. A comparator 50 forms alogic "1" output signal only when the data value on channel 1 equals thedata value on channel 2. Otherwise, the output of the comparator 50 islogic "0".

A comparator 52 forms a logic "1" output signal if the data value onchannel 3 exceeds the magnitude of the data value of the data inchannel 1. Should the data value on channel 1 exceed the data value onchannel 3, the comparator 52 forms a logic "0" output signal. Acomparator 54 forms a logic "1" output signal only when the data valueof the data on both channels 1 and 3 are equal. Otherwise, the output ofthe comparator 54 is a logic "0". Similarly, a comparator 56 forms alogic "1" if the data on channel 2 exceeds the magnitude of the datavalue on channel 3. If the data value on channel 3, however, exceeds thedata value on channel 2, the comparator 56 forms a logic "0" outputsignal. Finally, a comparator 58 forms a logic "1" signal only when thedata value of the data on channels 2 and 3 are equal. Otherwise, theoutput of the comparator 58 is a logic " 0" output.

The output signals from the foregoing comparators are furnished tovarious gating circuits shown in FIG. 5. In view of the number of suchcircuits and in order to preserve clarity in the drawings, the outputsfrom the comparators are assigned identifiers in accordance with thefollowing chart:

    ______________________________________                                        COMPARATOR OUTPUT    IDENTIFIER                                               ______________________________________                                        48                   i                                                        50                   ii                                                       52                   iii                                                      54                   iv                                                       56                   v                                                        58                   vi                                                       ______________________________________                                    

Other gates in FIG. 5 receiving these outputs as input signals are sodesignated by corresponding identifiers at their input terminals.

For example, the outputs from the comparators 48, 50, 52 and 54 areprovided to a gating circuit 60 which includes AND gate 62 connected tothe outputs of comparators 48 and 52 which forms a logic "1" outputsignal provided the conditions indicated at the output thereof arepresent with respect to the data magnitudes of channels 1, 2 and 3. Theoutput from the AND gate 62 is provided as an input to an OR gate 64.

The OR gate 64 is further connected to a NOR gate 66 which receives theoutput signals from comparator 48 and 52 and provides a logic "1" outputsignal provided the conditions indicated at the output of gate 66 arefulfilled. The OR gate 64 also receives input signals from thecomparators 50 and 54 and thus forms a logic "1" output signal in theevent the condition detected by either of comparators 50 or 54 isfulfilled.

Analysis of the four input signals to the OR gate 64 indicate that thegating circuit 60 functions to select the signal on channel 1 as themedian value signal in accordance with the control laws specified above,since the signal level of the signal on channel 1 either equals orexceeds the signal level on channel 2 and is less than or equal to thesignal on channel 3, or conversely, equals or exceeds the signal levelon channel 3 and is less than or equal to the signal level on channel 2.In such a situation, the OR gate 64 of the gating circuit 60 forms alogic "1" output signal which is furnished to an AND gate 74 permittingthe data contents of shift register 42 containing the data value of thesignals on channel 1 to pass therethrough as the median value signal.

The outputs from the comparators 52, 54, 56, and 58 are provided to agating circuit 76 which includes AND gate 78 connected to the outputs ofcomparators 56 and 52 which forms a logic "1" output signal provided theconditions indicated at the output thereof are present with respect tothe data magnitudes of channels 1, 2 and 3. The output from the AND gate78 is provided as an input to an OR gate 80. The OR gate 80 is furtherconnected to a NOR gate 82 which receives the output signals fromcomparator 52 and 56 and provides a logic "1" output signal provided theconditions indicated at the output of gate 82 are fulfilled. The OR gate80 also receives input signals from the comparators 54 and 58 and thusforms a logic "1" output signal in the event the condition detected byeither of comparators 54 or 58 is fulfilled.

Analysis of the four input signals to the OR gate 80 indicates that thegating circuit 76 functions to select the signal on channel 3 as themedian value signal in accordance with the control laws specified above,since the signal level of the signal on channel 3 either equals orexceeds the signal level on channel 2 and is less than or equal to thesignal on channel 1, or conversely, equals or exceeds the signal levelon channel 1 and is less than or equal to the signal level on channel 2.In such a situation, the OR gate 80 of the gating circuit 76 forms alogic "1" output signal which is furnished to an AND gate 90 permittingthe data contents of shift register 46 containing the data value of thesignals on channel 3 to pass therethrough as the median value signal.

The outputs from the comparators 48, 50, 56, and 58 are provided to agating circuit 92 which includes AND gate 94 connected to the outputs ofcomparators 48 and 56 which forms a logic "1" output signal provided theconditions indicated at the output thereof are present with respect tothe data magnitudes of channels 1, 2 and 3. The output from the AND gate94 is provided as an input to an OR gate 96. The OR gate 96 is furtherconnected to a NOR gate 98 which receives the output signals fromcomparator 48 and 56 and provides a logic "1" output signal provided theconditions indicated at the output of gate 98 are fulfilled. The OR gate96 also receives input signals from the comparators 50 and 58 and thusforms a logic "1" output signal in the event the conditions detected byeither of comparators 50 or 58 is fulfilled.

Analysis of the four input signals to the OR gate 96 indicate that thegating circuit 92 functions to select the signal on channel 2 as themedian value signal in accordance with the control laws specified above,since the signal level of the signal on channel 2 either equals orexceeds the signal level on channel 1 and is less than or equal to thesignal on channel 3; or conversely, equals or exceeds the signal levelon channel 3 and is less than or equal to the signal level on channel 1.In such a situation, the OR gate 96 of the gating circuit 92 forms alogic "1" output signal which is furnished to an AND gate 106 permittingthe data contents of shift register 44 containing the data value of thesignals on channel 2 to pass therethrough as the median value signals.

Finally, the single output stage of the MVS selector is a triple inputOR gate 108 receiving outputs from AND gates 74, 90 and 106.

As has been set forth above, each of the remaining median valueselectors 32, 34 and 36 and 40 are of like construction and function,with the exception of the different input channels provided thereto.

The selector 30 selects the median value signal from channels 1, 2 and 3and provides such signal as the input signal A to the absolute valuesubtractor/comparator 38. Further, the selectors 32, 34 and 36 in thefirst selector stage of the second selector station each operate in alike manner to the selector set forth in FIG. 5 and select the medianvalue signal from the three input signals provided thereto, furnishingsuch median value signals to the second selector stage 40 which forms anoutput signal B representing the median value signal of the three medianvalue signals selected in the first selector group of the secondselector stage. Further, the selector 40 provides the output signal B asas input to the subtractor/comparator 38 which functions in the mannerdescribed above.

It is evident to those skilled in the art that the new and improvedoperating sequence of steps above performed in the digitalimplementation operating in accordance with the control laws set forthabove could equally as well be performed in a properly programmedgeneral purpose digital computer which would perform comparisons todetermine median value signals between two groups of the input signals,determine median value signals from each section, subtract the absolutevalue of the median value signals in each section and compare thesubtraction results to a predetermined reference level stored in memoryto select a primary control signal for provision to the control computer10.

ANALOG IMPLEMENTATION

In the event that the present invention is to be performed on analogsignals, input analog data would first be provided to ananalog-to-digital (A/D) converter 116 which would convert the input datafrom each of the four channels into digital data which would befurnished as input signals to the digital selector F described above inFIGS. 2 and 5 and the proper control signal would then be furnished asan input signal to a digital-to-analog (D/A) converter 118 where itwould be again converted into an analog value representing the propercontrol signal. Of course, analog comparators and gating circuitsoperating according to the principles of the control laws and in themanner of the median value selector digital circuit of FIG. 5 could aswell be used.

OPERATION OF INVENTION

In the operation of the present invention, input data from the groups ofsensors S are collected in the multiplexer slot/demultiplexer circuits22 and provided in parallel, redundant groups through the input/outputbusses 24 to each of the control computers 10 through the selectionfilters F associated therewith. The selection filters F group the inputsignals into groups of three and compare the input signal so that themedian value signal of the three input signals can be detected. Thedetected median value signals from the median value selector operatorsare then compared in the subtractor/comparator operator 38 to determineif any of the detected median value signals exceeds the others by anamount greater than the signal level for a failed sensor. If this is thecase, the excessive detected median value signal is provided as thecontrol signal to the control computer 10. If the converse is the case,the lowest amplitude detected median value signal is provided as theproper control signal to the control computer 10.

Since the comparison level in the comparator 38 represents the maximumpossible output of a rate gyro sensor which has failed to null, with thepresent invention, any rate gyro output level which exceeds such amaximum possible output is logically selected. Thus, even in the eventof dual null failures during quiescent operation, the selection filter Fof the present invention continually reconfigures around dual nullfailures, instantly switching to the proper control signal at the timeof the first null failure (FIG. 3) and then again at the time of thesecond null failure (FIG. 3). It is to be noted that with the presentinvention, reconfiguration by the selection filter F to the propercontrol signal occurs prior to detection and identification of thenature of the failure by the failure detection operator 26. Thus, withthe present invention, null failed or hardover failed sensors aredisregarded in redundancy management until such time as sensor readingrates increase. At this time, the redundancy management techniques willbe more able to distinguish null output from proper sensor outputs anddetect rate gyro null failures. Further, with the present invention, theredundancy management techniques of the present invention permit fastreconfiguration with minimal processing time required of the controlcomputer 10 and with minimal requirements on the memory resources of thecontrol computer 10, allowing redundancy management implementation tolater detect failures at a slower processing rate.

The foregoing disclosure and description of the invention areillustrative and explanatory thereof, and various changes in the size,shape, materials, components, circuit elements, wiring connections andcontacts, as well as in the details of the illustrated circuitry andconstruction may be made without departing from the spirit of theinvention.

We claim:
 1. An apparatus for selecting a primary control signal forredundancy management in a system having a plurality of sensorsproviding input signals in parallel to a control computer to provide thecomputer with a primary control signal representing an output from aproperly operating sensor, comprising:(a) selector means for receivingand comparing input signals in groups of three from the sensors anddetecting the median value signal of the three input signals; (b)comparator means for comparing the detected median value signals todetemine if any one of the detected median value signals exceeds theothers by an amount greater than the signal level for a failed sensor;(c) said comparator means further including means for transmitting tothe control computer as the primary control signal a detector medianvalue signal which exceeds the others by an amount greater than thesignal level for a failed sensor and means for transmitting to thecontrol computer as the primary control signal the least of the detectedmedian value signals when no detected median value so exceeds theothers.
 2. The apparatus of claim 1, wherein said comparator meanscomprises:comparator means for comparing the detected median valuesignals to determine if any one of the detected median value signalsexceeds the others by an amount greater than the signal level for a nullfailed sensor.
 3. The apparatus of claim 1, wherein said comparatormeans comprises:(a) means for forming a difference signal representingthe difference between absolute values of the detected median valuesignals; and (b) means for comparing the difference signal with thesignal level for a failed sensor.
 4. The apparatus of claim 1, whereinthe sensors are sensors in an avionic system.
 5. The apparatus of claim4, wherein the sensors include accelerometers.
 6. The apparatus of claim4, wherein the sensors include gyroscopes.
 7. The apparatus of claim 1,wherein said selector means comprises:(a) a first selector section forreceiving three input signals for detecting the median value signal ofsuch input signals; (b) a second selection section having:(1) an initialselector stage having at least three selectors, each for detecting themedian value signal of such input signals furnished thereto; and (2) afurther selector stage having as inputs the median value signals fromsaid initial selector stage for detecting the median value signal ofsuch input signals.
 8. The apparatus of claim 7, wherein said comparatormeans comprises:means for comparing the detected median value signalsfrom said first selection section and said second selection section todetermine if any one of the detected median value signals exceeds theothers by an amount greater than the signal level for a failed sensor.9. An apparatus for selecting a primary control signal for redundancymanagement in a system having a plurality of groups of sensors, eachsensor group providing input signals in parallel to a plurality ofcontrol computer to provide the computers with primary control signalsrepresenting outputs from properly operating sensors, comprising:(a)selector means for receiving and comparing input signals in groups ofthree from the sensors and detecting the median value signal of thethree input signals; (b) comparator means for comparing the detectedmedian value signals to detemine if any one of the detected median valuesignals exceeds the others by an amount greater than the signal levelfor a failed sensor; (c) said comparator means further including meansfor transmitting to the control computer as the primary control signal adetected median value signal which exceeds the others by an amountgreater than the signal level for a failed sensor and means fortransmitting to the control computer as the primary control signal theleast of the detected median value signals when no detected median valueso exceeds the others.
 10. A method of selecting a primary controlsignal for redundancy management in a system having a plurality ofsensors providing input signals in parallel to a control computer toprovide the computer with a primary control signal representing anoutput from a properly operating sensor, comprising the steps of:(a)receiving and comparing input signals in groups of three from thesensors and detecting the median value signal of the three inputsignals; (b) comparing the detected median value signals to determine ifany one of the detected median value signals exceeds the others by anamount greater than the signal level for a failed sensor; (c)transmitting to the control computer as the primary control signal as adetector median value signal which exceeds the others by an amountgreater than the signal level for a failed sensor; and (d) transmittingto the control computer as the primary control signal the least of thedetected median value signals when no detected median value so exceedsthe others.
 11. The method of claim 10, wherein said step of comparingcomprises:comparing the detected median value signals to determine ifany one of the detected median value signals exceeds the others by anamount greater than the signal level for a null failed sensor.
 12. Themethod of claim 10, wherein said step of comparing comprises:(a) forminga difference signal representing the difference between absolute valuesof the detected median value signals; and (b) comparing the differencesignal with the signal level for a failed sensor.
 13. The method ofclaim 10, wherein the sensors are sensors in an avionic system.
 14. Themethod of claim 13, wherein the sensors include accelerometers.
 15. Themethod of claim 13, wherein the sensors include gyroscopes.
 16. Themethod of claim 10, wherein said step of receiving and comparing inputsignals comprises:(a) dividing the received signals into two groups; and(b) comparing the input signals of the two groups to determine adetected median value signal in each of the two groups.
 17. The methodof claim 16, wherein said step of comparing the detected median valuesignals comprises:comparing the detected median value signals from thefirst group and the second group to determine if any one of the detectedmedian value signals exceeds the others by an amount greater than thesignal level for a failed sensor.
 18. A method of selecting a primarycontrol signal for redundancy management in a system having a pluralityof groups of sensors, each sensor group providing input signals inparallel to a plurality of control computers to provide the computerswith primary control signals representing outputs from properlyoperating sensors, comprising the steps of:(a) receiving and comparinginput signals in groups of three from the sensors and detecting themedian value signal of the three input signals; (b) comparing thedetected median value signals to determine if any one of the detectedmedian value signals exceeds the others by an amount greater than thesignal level for a failed sensor; (c) transmitting to the controlcomputer as the primary control signal a detector median value signalwhich exceeds the others by an amount greater than the signal level fora failed sensor; and (d) transmitting to the control computer as theprimary control signal the least of the detected median value signalswhen no detected median value so exceeds the others.